Passkey auth bypass via User Verified flag validation gap in relying parties

Affected Systems

Relying parties (websites/services) implementing passkey authentication that fail to validate the User Verified (UV) flag in WebAuthn assertions. Affects passwordless authentication systems across multiple platforms. Specific research focuses on Google synced passkeys in Chrome on Windows with TPM, but the validation gap is a broader implementation issue across the passkey ecosystem.

Exploitation Status

Proof-of-concept attacks disclosed by Unit 42 researchers. Three attack variants demonstrated: Pass-ta-key (account takeover without device unlock), Silver Pass-ta-key (bypass biometric verification), and Golden Pass-ta-key (extract all synced passkey private keys). Requires pre-existing malware on victim endpoint. Responsibly disclosed to affected vendors. Active exploitation in the wild unknown.

Business Impact

Passwordless authentication systems may be downgraded from multi-factor to single-factor authentication when relying parties do not enforce User Verified flag validation. Attackers with endpoint malware can authenticate to passkey-protected accounts without user interaction, device unlock, or biometric verification—undermining core security assumptions of passkey implementations. Synced passkey private keys can be extracted and traded on credential black markets, reintroducing risks that passkeys were designed to eliminate. Organizations relying on passkeys as MFA replacement are at risk if their identity providers or SaaS applications fail to validate UV flags properly.

Urgency

🟡 Within a week

Recommended Actions

• Audit all relying party implementations (internal apps, SaaS integrations) to verify User Verified (UV) flag is enforced during WebAuthn assertion validation—consult WebAuthn spec section 7.2
• Deploy endpoint detection rules to monitor Chrome sync database access patterns (%LocalAppData%\Google\Chrome\User Data\*\Sync Data\LevelDB) and Google Cloud Authenticator process behavior for anomalous credential access
• Enable Cortex Cloud Identity Security or equivalent ITDR solutions to detect passkey enrollment anomalies and authentication without proper user verification signals
• Require hardware-bound passkeys (FIDO2 security keys) for privileged accounts instead of synced passkeys until vendors address cloud authenticator trust model weaknesses
• Review Google Workspace and Chrome Enterprise policies to restrict passkey sync to managed devices with endpoint protection and enforce device trust attestation where available